# 生成RSA私钥：

# openssl genrsa -out conf/server.key 2048
# 生成RSA私钥，命令的最后一个参数，将指定生成密钥的位数，如果没有指定，默认512

 # 生成ECC私钥：
# openssl ecparam -genkey -name secp384r1 -out conf/server.key
openssl ecparam -genkey -name secp384r1 -out conf/server.key
# 生成ECC私钥，命令为椭圆曲线密钥参数生成及操作，本文中ECC曲线选择的是secp384r1

 # 生成公钥
# openssl req -new -x509 -sha256 -key conf/server.key -out conf/server.pem -days 3650
# openssl req：生成自签名证书，-new指生成证书请求、-sha256指使用sha256加密、-key指定私钥文件、-x509指输出证书、-days 3650为有效期

 # Country Name (2 letter code) [AU]:CN
# State or Province Name (full name) [Some-State]:guangdong
# Locality Name (eg, city) []:shantou
# Organization Name (eg, company) [Internet Widgits Pty Ltd]:
# Organizational Unit Name (eg, section) []:dnb
# Common Name (e.g. server FQDN or YOUR name) []:
# Email Address []:

 # CA
# 生成 Key
openssl genrsa -out conf/ca.key 2048
# 生成密钥
openssl req -new -x509 -days 7200 -key conf/ca.key -out conf/ca.pem

 # 填写信息
# Country Name (2 letter code) []:CN
# State or Province Name (full name) []:guangdong
# Locality Name (eg, city) []shantou
# Organization Name (eg, company) []
# Organizational Unit Name (eg, section) []:
# Common Name (eg, fully qualified host name) []:
# Email Address []:

# Server
# 生成 CSR
openssl req -new -key conf/server.key -out conf/server.csr
# 填写信息
# Country Name (2 letter code) []:
# State or Province Name (full name) []:
# Locality Name (eg, city) []:
# Organization Name (eg, company) []:
# Organizational Unit Name (eg, section) []:
# Common Name (eg, fully qualified host name) []:
# Email Address []:
#
# Please enter the following 'extra' attributes
# to be sent with your certificate request
# A challenge password []:

# 基于 CA 签发
openssl x509 -req -sha256 -CA conf/ca.pem -CAkey conf/ca.key -CAcreateserial -days 3650 -in conf/server.csr -out conf/server.pem
# Client
# 生成 Key
openssl ecparam -genkey -name secp384r1 -out client.key
# 生成 CSR
openssl req -new -key client.key -out client.csr
# 基于 CA 签发
openssl x509 -req -sha256 -CA conf/ca.pem -CAkey conf/ca.key -CAcreateserial -days 3650 -in conf/client.csr -out conf/client.pem